Mitigation code available
A 9.8 in the kernel's IPv4 TCP path, no fixed kernel for any Ubuntu release and a tracker page that lists no mitigation. The fix you cannot install yet still tells you what the bug needs, and what a bug needs can be taken away.
Seven of our remediation roles are public, with the shared library they depend on. The fixes themselves are a morning's work each. What took the time was deciding what a pack must declare and demonstrate before anything will run it as root across a fleet, and only some of those gates exist today.
Mitigation code available
PHP2Shell and the Brotli decoder bug were patched the same day. One got the emergency response, the other did not, and the quiet one is harder to find on your estate because the obvious version strings lie about it. There is a role you can run to work out what you have.
Mitigation code available
Two unauthenticated remote code execution bugs in PHP core, CVSS 9.2, with upstream releases out the same afternoon. The patch is the easy part. CISA's first instruction is to inventory every system running any PHP, and on most estates nobody can do that tonight.
Mitigation code available
Next.js used an internal header to mark its own subrequests, and anyone could send it. Authorisation checks made in middleware were skipped. The mitigation is a header strip at the proxy, which works because the boundary was in the wrong place to begin with.
Mitigation code available
regreSSHion is unauthenticated root on sshd, and the published workaround turns it into a denial of service. Five days of reading advisories to find that the only safe verdict a scanner can reach, on a lot of hosts, is "unknown".
Mitigation code available
A backdoor in xz-utils 5.6.0 and 5.6.1, planted over a multi-year social engineering campaign against a burnt-out maintainer, and caught by one engineer who wondered why SSH was half a second slow.
Mitigation code available
PwnKit is a local privilege escalation in pkexec affecting every version since 2009. Qualys published a one-line workaround; Red Hat published a note saying do not use it. We shipped a role that does both things, and the interesting part is which hosts get which.
Mitigation code available
Six days after Log4Shell went public we shipped an Ansible role that stripped JndiLookup from every JAR it could find, a week ahead of the joint advisory. Almost none of those days went on the fix. They went on answering where Log4j was running, which is a question about your own estate rather than about Apache.
